This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-86811 | BDVDB-2026-402924 Detail

ApacheApache TomEE

Description#

The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Impact#

No impact statement in the source data.

Weaknesses#

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.